CCSP Cloud Security Operations Practice Question
A cloud security team is implementing a centralized logging solution for AWS. They need to ensure that all API activity in their production account is logged and that the logs are stored immutably for 7 years to meet compliance requirements. Which service should they use to capture the API activity?
⚠ Common exam trap
Candidates often confuse AWS Config with CloudTrail, as both are auditing services, but only CloudTrail records API activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice for capturing all API calls. It integrates with Amazon S3, where logs can be stored with Object Lock to enforce immutability for compliance. The other services either focus on resource configuration, network traffic, or application logs, and cannot provide the comprehensive API auditing required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
Amazon CloudWatch Logs is designed for monitoring, storing, and accessing log files from AWS resources like EC2 instances, Lambda functions, and other services. It does not natively capture AWS API activity across the account. While it can store logs, it lacks the comprehensive API activity auditing provided by CloudTrail and does not support S3 Object Lock for immutability.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configurations and changes, not API activity. It evaluates resource compliance against desired configurations but does not log every API call. While useful for compliance auditing, it cannot fulfill the requirement to capture all API activity. Additionally, AWS Config does not provide immutable log storage with S3 Object Lock.
- ✗
Amazon VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic information for network interfaces in a VPC. They record metadata about network flows, not API activity. They are useful for network monitoring and security analysis but do not provide the API-level auditing required. Furthermore, VPC Flow Logs are not designed for long-term immutable storage with S3 Object Lock.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail records API activity in an AWS account, including actions taken by users, roles, and AWS services. It provides event history and can deliver logs to an S3 bucket, which can be configured with Object Lock for immutability. This meets the requirement to capture all API activity and retain logs immutably for 7 years.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.